A file upload form on a corporate intranet only accepts images. The server-side validation checks the file extension and the MIME type from the uploaded file's header. A penetration tester wants to upload a PHP web shell. Which technique is most likely to bypass the current validation?

Append a null byte to the filename, e.g., 'shell.php%00.jpg'

Change the Content-Type header to 'image/jpeg' while keeping the .php extension.

Use a double extension like 'shell.jpg.php'

Craft a file with a valid JPEG magic header (e.g., FFD8FF) but include PHP code in the middle or end of the file.

A small business runs a website that allows users to upload profile pictures. The upload script only checks that the file size is under 2 MB and then moves the file to the uploads directory. An attacker uploads a file named 'profile.php' containing a web shell. What is the MOST likely immediate impact?

The attacker can read the source code of the application.

The attacker can modify the website's HTML files.

The attacker can execute arbitrary commands on the web server.

The attacker can steal the database credentials from the server.

EC-CouncilWeb Application Hacking and Security

Domain 7Objective 3

Arbitrary File Upload and Download WAHS Practice Questions (Page 6)

Part of the File Inclusion and Upload Attacks domain, which makes up ~7% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~10–17 in this domain), expect 3–6 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

10concepts

Questions 26–30

26foundation · easy
An attacker uploads a file named 'shell.php.jpg' to bypass a filter that only allows image files. What is this technique called?
Select an answer first
27foundation · easy
In older PHP versions, an attacker could upload a file named 'shell.php%00.jpg' to bypass extension filters. What is this technique called?
Select an answer first
28application · medium
A file upload form on a corporate intranet only accepts images. The server-side validation checks the file extension and the MIME type from the uploaded file's header. A penetration tester wants to upload a PHP web shell. Which technique is most likely to bypass the current validation?
Select an answer first
29application · medium
A small business runs a website that allows users to upload profile pictures. The upload script only checks that the file size is under 2 MB and then moves the file to the uploads directory. An attacker uploads a file named 'profile.php' containing a web shell. What is the MOST likely immediate impact?
Select an answer first
30foundation · easy
Which of the following is a technique to bypass file upload filters by manipulating the Content-Type header?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to WAHS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.

Arbitrary File Upload and Download WAHS Practice Questions (Page 6)

Questions 26–30

An attacker uploads a file named 'shell.php.jpg' to bypass a filter that only allows image files. What is this technique called?

In older PHP versions, an attacker could upload a file named 'shell.php%00.jpg' to bypass extension filters. What is this technique called?

A file upload form on a corporate intranet only accepts images. The server-side validation checks the file extension and the MIME type from the uploaded file's header. A penetration tester wants to upload a PHP web shell. Which technique is most likely to bypass the current validation?

Which of the following is a technique to bypass file upload filters by manipulating the Content-Type header?

Keep studying — File Inclusion and Upload Attacks